Web services in a Web company Hugo Haas & Mark Nottingham W3C - PowerPoint PPT Presentation

Web services in a Web company Hugo Haas & Mark Nottingham W3C Workshop on Web Services for Enterprise Computing February 28, 2007 1

Yahoo! • Web company • Various platforms & tools: – C/C++, PHP, Perl, some Java – Open-source • Several POVs about services 2

Web services flavors • Anything which exposes an API • Several flavors: – HTTP-based (I.e. not SOAP) – SOAP-based • Each have their advantages and issues 3

SOAP-based Web services 4

Advertiser Web Services 5

Yahoo! Mail: 2B+ SOAP messages / week 6

What pushes people towards SOAP • Mainly: code generation • Who our customers are • Other reasons: historical, etc. 7

Issues with SOAP • Interoperability: when the code generation dream becomes a nightmare • WS-* support poor; typically, not used at Y! • Complexity 8

HTTP-based services 9

Most of our external services 10

Why? • Developers familiar with the Web • No special tool or library needed • Audience: – Web developers doing PHP, Python, JavaScript, etc. 11

Description and code generation • People want to write code fast • Big draw towards SOAP • However: beware of interoperability issues • Description language: – Documentation – Code generation 12

Authentication headache 1. User Cache Web Service 1 Service 2 application 3. Application 5. Service 1 Partner 4. Cache Yahoo! 2. Partner 13

Limitations of existing HTTP authentication schemes • Limitation of the number of entities identifiable • Cross-host in a domain • Basic auth: – Poor security • Digest auth: – Not widespread implementation – Chatty • Not to mention browser-side issues 14

Real world work-arounds • Cookies • In-URL credentials • Custom authentication schemes • Custom headers • Main challenges: – Tool support – Caching 15

Major issue • Some requirements – Support for multiple credentials – Support for both browser & tools – Cross-host – Support for custom login interface • SOAP not much better: WS-Security not widespread 16

Suggestions 17

SOAP-based services • Stop doing more extensions! • Make the basic stuff work in an interoperable way first • XML Databinding: saddened by lack of vendor recognition of the issue • WSDL 2.0 • Focus on interoperability 18

HTTP-based services • Tools • Recognize the use of cookies for authentication • Interest in HTTP auth in various places (e.g. IETF) – Put down requirements – Work with the community at large 19

20